MDL-28574 webservice: Allow admins to manage tokens created by others.

Until now, admins could only modify (or even see) tokens they have
created themselves. Tokens created by other users or even other admins
were invisible unless you were looking into the database. In case there
are former admins, their successors can be unable to inspect or delete
existing tokens.

admin/webservice/tokens.php

@@ -101,7 +101,7 @@ switch ($action) {
         break;
 
     case 'delete':
-        $token = $webservicemanager->get_created_by_user_ws_token($USER->id, $tokenid);
+        $token = $webservicemanager->get_token_by_id_with_details($tokenid);
 
         //Delete the token
         if ($confirm and confirm_sesskey()) {

lib/adminlib.php

@@ -9531,6 +9531,7 @@ class admin_setting_managewebservicetokens extends admin_setting {
         $strtoken = get_string('token', 'webservice');
         $strservice = get_string('service', 'webservice');
         $struser = get_string('user');
+        $strcreator = get_string('tokencreator', 'webservice');
         $strcontext = get_string('context', 'webservice');
         $strvaliduntil = get_string('validuntil', 'webservice');
         $striprestriction = get_string('iprestriction', 'webservice');
@@ -9538,8 +9539,8 @@ class admin_setting_managewebservicetokens extends admin_setting {
         $return = $OUTPUT->box_start('generalbox webservicestokenui');
 
         $table = new html_table();
-        $table->head  = array($strtoken, $struser, $strservice, $striprestriction, $strvaliduntil, $stroperation);
-        $table->colclasses = array('leftalign', 'leftalign', 'leftalign', 'centeralign', 'centeralign', 'centeralign');
+        $table->head  = array($strtoken, $struser, $strservice, $striprestriction, $strvaliduntil, $strcreator, $stroperation);
+        $table->colclasses = array('leftalign', 'leftalign', 'leftalign', 'centeralign', 'centeralign', 'leftalign', 'centeralign');
         $table->id = 'webservicetokens';
         $table->attributes['class'] = 'admintable generaltable';
         $table->data  = array();
@@ -9549,10 +9550,11 @@ class admin_setting_managewebservicetokens extends admin_setting {
         //TODO: in order to let the administrator delete obsolete token, split this request in multiple request or use LEFT JOIN
 
         //here retrieve token list (including linked users firstname/lastname and linked services name)
-        $sql = "SELECT t.id, t.token, u.id AS userid, u.firstname, u.lastname, s.name, t.iprestriction, t.validuntil, s.id AS serviceid
-                  FROM {external_tokens} t, {user} u, {external_services} s
-                 WHERE t.creatorid=? AND t.tokentype = ? AND s.id = t.externalserviceid AND t.userid = u.id";
-        $tokens = $DB->get_records_sql($sql, array($USER->id, EXTERNAL_TOKEN_PERMANENT));
+        $sql = "SELECT t.id, t.token, u.id AS userid, u.firstname, u.lastname, s.name, t.iprestriction, t.validuntil,
+                   s.id AS serviceid, c.id AS creatorid, c.username AS creator
+                  FROM {external_tokens} t, {user} u, {external_services} s, {user} c
+                 WHERE t.tokentype = ? AND s.id = t.externalserviceid AND t.userid = u.id AND t.creatorid = c.id";
+        $tokens = $DB->get_records_sql($sql, array(EXTERNAL_TOKEN_PERMANENT));
         if (!empty($tokens)) {
             foreach ($tokens as $token) {
                 //TODO: retrieve context
@@ -9594,7 +9596,12 @@ class admin_setting_managewebservicetokens extends admin_setting {
                     }
                 }
 
-                $table->data[] = array($token->token, $useratag, $token->name, $iprestriction, $validuntil, $delete);
+                $creatorprofileurl = new moodle_url('/user/profile.php?id='.$token->creatorid);
+                $creatoratag = html_writer::start_tag('a', array('href' => $creatorprofileurl));
+                $creatoratag .= $token->creator;
+                $creatoratag .= html_writer::end_tag('a');
+
+                $table->data[] = array($token->token, $useratag, $token->name, $iprestriction, $validuntil, $creatoratag, $delete);
             }
 
             $return .= html_writer::table($table);

webservice/lib.php

@@ -402,6 +402,34 @@ class webservice {
         return $token;
     }
 
+    /**
+     * Return a token of an arbitrary user by tokenid, including details of the associated user and the service name.
+     * If no tokens exist an exception is thrown
+     *
+     * The returned value is a stdClass:
+     * ->id token id
+     * ->token
+     * ->firstname user firstname
+     * ->lastname
+     * ->name service name
+     *
+     * @param int $tokenid token id
+     * @return stdClass
+     */
+    public function get_token_by_id_with_details($tokenid) {
+        global $DB;
+        $sql = "SELECT
+                        t.id, t.token, u.id AS userid, u.firstname, u.lastname, s.name
+                    FROM
+                        {external_tokens} t, {user} u, {external_services} s
+                    WHERE
+                        t.id=? AND t.tokentype = "
+            . EXTERNAL_TOKEN_PERMANENT
+            . " AND s.id = t.externalserviceid AND t.userid = u.id";
+        $token = $DB->get_record_sql($sql, array($tokenid), MUST_EXIST);
+        return $token;
+    }
+
     /**
      * Return a database token record for a token id
      *